ACL Success Story – Retail – Metcash Limited

2012-05-01

Metcash Limited

Applied analytics support control assurance in a diverse business environment

“Fraud prevention and detection is an ongoing focus. ACL Direct Link collects data from SAP overnight and the results of the tests including ‘high probability exceptions’ are delivered to some 70-end users, broadening and deepening our monitoring strategy.”

Company Profile

Listed on the Australian Stock Exchange (ASX), Metcash Limited is Australia’s largest food and liquor wholesaler, turning over US$12.6 billion annually with a market capitalisation of US$3.1 billion. Metcash Limited has 5,000 employees and two major divisions: Metcash Food and Grocery, and Australian Liquor Marketers.

Objectives

Operating in a mature market, Metcash competes against a duopoly of the major Australian grocery chains. There is limited opportunity to grow the business by increasing market share, and a complex regulatory environment that includes onerous food safety regulations and laws prohibiting anti-competitive behavior.

Each area of the Metcash business uses different data types, applications, manual processes and technical platforms, including a number of legacy systems. The business is diverse, and while some divisions maintain an effective control environment, others suffer from high staff turnover and experience occassional control breakdowns.

Metcash internal auditors work to provide financial and operational risk assurance, while adding value through consulting activities. The business is varied and geographically broad enough to minimise the impact of a single incident, but the inconsistent control environment increases exposure to cost (or revenue) leakage. For example, independent Metcash retailers maintain their own systems, which can be vulnerable to hacking and data theft, and limit the capture and aggregation of retail sales data. Maintaining a culture of compliance across the enterprise can be difficult for this diverse organisation.

Implementation and Planning

Over the past several years, the Metcash Internal Audit team has developed and implemented a robust controls analysis environment. A sophisticated ACL solution and DirectLink for SAP ERP provide an uninterrupted connection to SAP system data, while at least 70 standardised tests analyse full data files and deliver electronic results to end users. The complex Metcash computing environment includes a variety of different platforms, systems and data types, which the ACL solution can easily access and convert into a standard format. Current analysis categories include asset management, fraud detection, accounting, data integrity, logical security, compliance and consulting.

“The ACL solution works across the Metcash organization to analyze complete data sets and highlight evidence of control breakdowns or heightened risk exposure.”

Currently, the IA team is focused on risk management analysis by developing automated tests that gather “risk indicator” data across the business for boardlevel review. Before implementing the ACL solution, auditors collected risk-related data manually – leading to quality and timeliness issues. Now, automated applications run overnight and deliver results by 7 a.m. the following day.

Results

Metcash has used ACL technology for a wide range of test types including:

duplicate testing

vendor master file management

non-trade procurement

warehouse stock adjustments

The Metcash IA team runs at least 70 audit analytics on a daily or weekly basis. The tests have led to direct cost savings, fraud prevention and detection, and process improvements.

Over three years data analytics have identified duplicate payments worth more than US$8.4 million and uncovered key control issues.

Change records from the Metcash Finance ERP system are routed to management for further review – ensuring all security bypass actions are fully authorised.

Analytics highlight Metcash purchases made from unauthorised suppliers, leading to significant cost savings and more fully realised contract benefits

The IA team also uses ACL to capture and present 90 hard-copy exception reports in a standard, modifiable digital form – lowering process costs and highlighting error trends.

Next Steps

The ACL solution works across the Metcash organisation to analyse complete data sets and highlight evidence of control breakdowns or heightened risk exposure. The benefits of ACL technology have been broadly disseminated across the entire Metcash business. Almost all IA reviews now include ACL analytics. As further evidence of the team’s success, the Chief Audit Executive recently flagged the routine analysis efforts for further development – improving the reach and scope of Internal Audit across the business.